There are several modules owned by the J2EE team which export friend APIs but
export their packages using public-pacakges. They should use friend-packages
instead and explicitly list their friends. I was able to find the following
modules exporting public packages and having "friend" as the API category in the
arch document:

- j2ee/ejbapi
- j2ee/ddapi
- web/webapi
- websvc/websvcddapi
- websvc/registry
- websvc/core

The following modules export public packages without documenting it in the arch
document (it is not clear whether the API is intended to be public or friend) or
do not have an arch document at all:

- web/jspparser (exports org.netbeans.modules.web.jsps.parserapi as a public
package without mentioning it in arch/arch-web-jspparser.xml)
- web/jspsyntax (exports org.netbeans.modules.web.core.syntax.spi as a public
package without mentioning it in arch/arch-web-jspsyntax.xml. web/struts has a
dependency on web/jspsyntax but compiles without it -- does it need it?)
- websvc/customization (exports two packages, does not seem to have an arch
document)
- xml/catalog (exports org.netbeans.modules.xml.catalog.spi, does not seem to
have an arch document)
- xml/core (exports three packages without mentioning it in xml/core/arch.xml)

I also see that j2eeserver's arch.xml says the API is friend. I thought it was
meant to be public, what is correct?

j2ee/metadata exports a public package too, since that module was inteded to be
public. Now it seems it will be friend, so it should use friend-packages.